ci: fail CI gates when their exemption entries go stale

A moved or renamed file silently disarms the entry that named it,
letting new violations through instead of being caught. Both
check_authorized_dispatch.py and check_reconstructed_sql.py now scan
their exemption tables for entries that no longer match any file or
occurrence and fail the gate if any are found, and the now-dead
sql_loop.rs reference is dropped.

Author: farhan-syah

scripts/ci/check_authorized_dispatch.py

@@ -103,7 +103,6 @@
     ("control/array_sync/inbound.rs", "into_scope"),
     ("control/array_sync/inbound_propose.rs", "into_scope"),
     ("control/array_sync/snapshot_assembly.rs", "into_scope"),
-    ("control/server/native/dispatch/sql_loop.rs", "into_physical_task"),
     ("control/server/native/dispatch/sql_dispatch_task.rs", "into_physical_task"),
     ("control/server/sync/raft_dispatch/response.rs", "propose_sync_write"),
     ("control/server/sync/raft_dispatch/write.rs", "propose_sync_write"),
@@ -266,6 +265,35 @@ def public_raw_api_violations(rel: str, source: str) -> list[tuple[int, str]]:
     return found
 
 
+def stale_exemptions() -> list[str]:
+    """Report exemptions that no longer name a live occurrence.
+
+    An exemption is keyed on (path, symbol). Move the file or rename the
+    symbol and the entry stops matching anything — it does not fail, it
+    silently stops being an exemption, and the next occurrence added to
+    that path is waved through instead of being caught. Both halves of
+    this gate have already been disarmed that way by an ordinary file
+    move, so a dead entry is treated as a gate failure, not as tidiness.
+
+    The symbol is looked for in masked source, so an entry kept alive only
+    by a comment or a string literal still reports as dead.
+    """
+    stale: list[str] = []
+    for label, exemptions in (
+        ("ALLOWED_DEFINITIONS", ALLOWED_DEFINITIONS),
+        ("ALLOWED_REFERENCES", ALLOWED_REFERENCES),
+    ):
+        for rel, name in sorted(exemptions):
+            path = SRC / rel
+            if not path.is_file():
+                stale.append(f"{label}: ({rel!r}, {name!r}) names a file that does not exist")
+                continue
+            masked = mask_rust(path.read_text(encoding="utf-8"))
+            if not re.search(rf"\b{re.escape(name)}\b", masked):
+                stale.append(f"{label}: ({rel!r}, {name!r}) matches no occurrence in that file")
+    return stale
+
+
 def main() -> int:
     parser = argparse.ArgumentParser()
     parser.add_argument("--self-test", action="store_true")
@@ -274,6 +302,17 @@ def main() -> int:
         self_test()
         return 0
 
+    stale = stale_exemptions()
+    if stale:
+        print("ERROR: stale exemptions — the gate is disarmed where they point:", file=sys.stderr)
+        for entry in stale:
+            print(f"  {entry}", file=sys.stderr)
+        print(
+            "Repoint each entry at the code's current location, or drop it if the seam is gone.",
+            file=sys.stderr,
+        )
+        return 1
+
     errors: list[str] = []
     for path in SRC.rglob("*.rs"):
         rel = path.relative_to(SRC).as_posix()

scripts/ci/check_reconstructed_sql.py

@@ -871,12 +871,43 @@ def self_test() -> int:
     return 1 if failed else 0
 
 
+def stale_canonical_helpers() -> list[str]:
+    """Report PATH_CANONICAL_HELPERS entries that no longer name live code.
+
+    Each entry widens the gate for one file: the named helpers are read as
+    canonical there, so a bare call to one stops counting as unquoted
+    interpolation. The key is a path. Move the file and the entry keeps
+    widening nothing, while the helpers at their new home silently lose
+    their canonical status and the file starts reporting false violations —
+    which is how this gate came to fail on every pull request. A dead entry
+    is therefore a gate failure, not tidiness.
+    """
+    stale: list[str] = []
+    for rel, helpers in sorted(PATH_CANONICAL_HELPERS.items()):
+        path = RUST_ROOT / rel
+        if not path.is_file():
+            stale.append(f"{rel!r} names a file that does not exist")
+            continue
+        source = path.read_text(encoding="utf-8")
+        for helper in sorted(helpers):
+            if not re.search(rf"\b{re.escape(helper)}\b", source):
+                stale.append(f"{rel!r} exempts {helper!r}, which does not appear in that file")
+    return stale
+
+
 def main() -> int:
     parser = argparse.ArgumentParser()
     parser.add_argument("--self-test", action="store_true")
     args = parser.parse_args()
     if args.self_test:
         return self_test()
+    stale = stale_canonical_helpers()
+    if stale:
+        print("FAIL: stale canonical-helper exemptions — the gate is misaimed where they point:")
+        for entry in stale:
+            print(f"  {entry}")
+        print("\nRepoint each entry at the code's current location, or drop it if the helper is gone.")
+        return 1
     findings = scan_paths(path for root in SCAN_ROOTS for path in root.rglob("*.rs"))
     if findings:
         print(f"FAIL: {len(findings)} reconstructed-SQL gate violation(s):")